Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bundler to be integrated into Rubygems

github.com

Post reply on HN
Print view View original

11–20 of 26 posts

Re: Bundler to be integrated into Rubygems

#11

Post by stormbrew »

pilif wrote: post #9
yxhuvud wrote: post #8

Earlier quoted context omitted.

It sounds like npm quite easily can become a dependency hell where you have no idea whatsoever what code is actually being run.

On one hand that's certainly true. On the other: Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Does it matter to you whether $LIB bundles $OTHERLIB as a package or whether it just includes the source code of $OTHERLIB? Yes. I see the security implications of running an outdated $OTHERLIB, but that's $LIB's responsibility, no matter whether they i…

I'm not sure there's any universal answer to the questions you pose in your first paragraph. The problem is that sometimes you do care (sometimes a library is actually an interface into some kind of stateful machine) and sometimes you don't (when it's just objects that hold their own state). To some extent javascript gets a bit of a free ride on this question because most libraries are designed around there being only one global state machine (the event loop), but ruby doesn't impose an execution model on you.

Re: Bundler to be integrated into Rubygems

#12

Post by plorkyeran »

stormbrew wrote: post #11
pilif wrote: post #9

Earlier quoted context omitted.

On one hand that's certainly true. On the other: Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Does it matter to you whether $LIB bundles $OTHERLIB as a package or whether it just includes the source code of $OTHERLIB? Yes. I see the security implications of running an outdated $OTHERLIB, but that's $LIB's responsibility, no matter whether they i…

I'm not sure there's any universal answer to the questions you pose in your first paragraph. The problem is that sometimes you do care (sometimes a library is actually an interface into some kind of stateful machine) and sometimes you don't (when it's just objects that hold their own state). To some extent javascript gets a bit of a free ride on this question because most libraries are designed around there being onl…

Yeah, I think npm's model is the correct one for node, but it's not universally better than all others by any means. It's not possible at all in many languages, would result in absurd compilation times and disk space usage in compiled languages, and makes security audits much more difficult. It's certainly not very compatible with an environment where every dependency requires external approval.

Re: Bundler to be integrated into Rubygems

#13

Post by xs_kid »

djur wrote: post #10
plorkyeran wrote: post #4

Earlier quoted context omitted.

With Bundler, you have a single copy of each (version of each) library installed, and Bundler decides at runtime which to make visible (which is trivial with Gemfile.lock, since all of the interesting logic is done when creating that). This decision is a global one, so if you depend on two libraries that themselves depend on libfoo, both of those libraries have to use the same libfoo, and there's no difference betwee…

Rubygems doesn't have the luxury of providing that kind of system, though, because of how 'require' works in Ruby. AMD/RequireJS allows requires to be scoped, while Ruby requires dump directly into the global namespace.

Right and the guy of the last comment of the issue is proposing also an solution for it:

https://github.com/soveran/cargo

Re: Bundler to be integrated into Rubygems

#14

Post by ollysb »

xs_kid wrote: post #13
djur wrote: post #10

Earlier quoted context omitted.

Rubygems doesn't have the luxury of providing that kind of system, though, because of how 'require' works in Ruby. AMD/RequireJS allows requires to be scoped, while Ruby requires dump directly into the global namespace.

Right and the guy of the last comment of the issue is proposing also an solution for it: https://github.com/soveran/cargo

I was wondering how you could achieve the same level of isolation in ruby, this looks like a very interesting project. Ruby projects move fast and even though they're pretty good about semantic versioning this isn't enough to save you when your Gemfile starts filling up. Cargo looks like a huge improvement over require.

Re: Bundler to be integrated into Rubygems

#15

Post by stormbrew »

xs_kid wrote: post #13
djur wrote: post #10

Earlier quoted context omitted.

Rubygems doesn't have the luxury of providing that kind of system, though, because of how 'require' works in Ruby. AMD/RequireJS allows requires to be scoped, while Ruby requires dump directly into the global namespace.

Right and the guy of the last comment of the issue is proposing also an solution for it: https://github.com/soveran/cargo

No matter what it's too leaky an abstraction. Everything in the stdlib uses require. Every fundamental piece of ruby code not in the stdlib uses require. The process of getting from point A to point C involves crossing a point B so frustrating, limiting, and ugly no one is really willing to cross it.

Ruby's global constant namespace was probably a mistake in hindsight, but at this point it'd be a language fork to change it meaningfully.

Re: Bundler to be integrated into Rubygems

#18

Post by rschmitty »

plorkyeran wrote: post #4
ollysb wrote: post #3

From the bottom of the comments on that issue: sovereign> @drbrain It's a different approach, where a dependency resolver in runtime is no longer needed. I've been using that approach for the past six years, and during all that time I have been the happiest rubyist in town while my friends struggle with Bundler. The idea is to trade space for complexity. Once the gems are installed in isolation, there's no need for d…

With Bundler, you have a single copy of each (version of each) library installed, and Bundler decides at runtime which to make visible (which is trivial with Gemfile.lock, since all of the interesting logic is done when creating that). This decision is a global one, so if you depend on two libraries that themselves depend on libfoo, both of those libraries have to use the same libfoo, and there's no difference betwee…

Can't you just "vendor everything" and now each project will install all of the gems locally to vendor and not be concerned about global choices?

http://ryan.mcgeary.org/2011/02/09/vendor-everything-still-a...

Re: Bundler to be integrated into Rubygems

#20

Post by jrochkind1 »

pilif wrote: post #9
yxhuvud wrote: post #8

Earlier quoted context omitted.

It sounds like npm quite easily can become a dependency hell where you have no idea whatsoever what code is actually being run.

On one hand that's certainly true. On the other: Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2? Does it matter to you whether $LIB bundles $OTHERLIB as a package or whether it just includes the source code of $OTHERLIB? Yes. I see the security implications of running an outdated $OTHERLIB, but that's $LIB's responsibility, no matter whether they i…

> Do you care how $LIB does some work for you? Does it matter to you whether $LIB uses $OTHERLIB in version 0.1 or 0.2?

Only when debugging. But that's a pretty big 'only when'

Post reply on HN